Security audit

one-plaud-recording-several-differently-formatted-summaries

Security checks for vulnerabilities and agentic risk

Overview

The workflow matches its stated purpose, but it should be reviewed because it uses mutable install/update instructions while handling sensitive Plaud transcripts and Google Docs/Sheets data.

Review and pin the installer and referenced AgentPMT skills before use, and grant Plaud, Google Sheets, and Google Docs only the minimum permissions needed. Confirm that the target Google Docs and Sheets sharing settings are appropriate for confidential recordings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Skill Installation from Mutable Remote Sources
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 14–37
Vulnerability Type: Supply-chain risk caused by unpinned remote dependencies
Risk Level: Medium

Vulnerable Code

markdown
If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples. ## Required Setup - AgentPMT overview: `../what-is-agentpmt`. - Account MCP/REST setup: `../agentpmt-account-mcp-rest-api-setup`. Core AgentPMT setup skills: - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

text
The same unpinned installation pattern is repeated for workflow dependencies at lines 56, 65, 72, 81, 92, 99, and 104–107. ### Technical Analysis The Skill instructs users to run `npx skills add` and `openclaw skills install` without specifying an immutable package version, repository commit, cryptographic checksum, or signature. Both the installer and retrieved Skill content can therefore change after this file has been audited. The seven-day freshness instruction increases exposure by encouraging users to retrieve the latest mutable content repeatedly. If an npm package, repository, distributi ...[truncated 1942 chars]
Remediation: View remediation
Remediation Suggestions

Pin the installer and every Skill dependency to exact, audited versions or immutable repository commit hashes.

Replace commands such as npx skills add AgentPMT/agent-skills with version-qualified commands that cannot silently resolve newer releases.

Publish cryptographic checksums or signed manifests for all downloaded Skill content and verify them before installation.

Maintain a reviewed lockfile or dependency manifest recording exact versions and integrity hashes.

Replace automatic freshness-based reinstallation with an explicit update process that includes change review, signature verification, and user approval.

Review each dependency’s instructions, executable content, requested permissions, and external endpoints before enabling it.

Grant Plaud and Google connectors only the minimum scopes required by this workflow, and isolate them from unrelated recordings, sheets, and documents where supported.

Monitor publisher and dependency changes, and revoke credentials promptly if package or maintainer compromise is suspected.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description explains the workflow benefits but does not clearly warn users that it reads Plaud transcripts and writes generated summaries plus recording metadata into Google Docs and Google Sheets. That omission can cause users to authorize processing and cross-service propagation of sensitive meeting content without informed consent, increasing privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run npx skills ... without pinning a specific package version. Because npx resolves and executes the latest matching package at runtime, a compromised upstream package, typosquat, or breaking release could change what code is executed during installation and expose the user to supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This installation instruction invokes npx skills without a pinned version, allowing unreviewed upstream changes to affect what runs on the user's system. In a skill-distribution context, that creates a real supply-chain exposure because users are encouraged to execute these commands directly from documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documented npx skills command is not version-locked, so the fetched executable may differ over time or be replaced through an upstream compromise. That makes the skill's setup path non-reproducible and increases the chance of arbitrary code execution through the package-install chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This line repeats an unpinned npx skills installation path, which implicitly trusts the current registry state at execution time. If the package or one of its install-time dependencies is tampered with, users following the documentation could execute malicious code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill links a dependency installation command that uses unpinned npx, creating a supply-chain risk during setup. Because this is part of the stated workflow prerequisites, users are likely to execute it as-is, which increases practical exploitability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command at this line fetches and runs skills without constraining the version, so the executed code can change without notice. In setup documentation for remote-tool skills, that is a valid security issue because the user is being told to trust dynamic package resolution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned npx skills reference exposes users to upstream package substitution or malicious updates at install time. The danger is amplified by the fact that the skill coordinates access to external services, so compromise of the setup tool could lead to credential theft or broader workflow manipulation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The setup command remains unpinned, which means users may execute different code depending on when they run it. This is a classic documentation-driven supply-chain vulnerability because the skill encourages direct execution of a mutable package reference.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command shown on this line relies on npx without a fixed package version, enabling untrusted upstream changes to affect installation behavior. Since the skill processes user transcripts and metadata, compromise of the installer path could expose sensitive meeting content or connected account tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Another unpinned npx skills invocation appears here, which is a true supply-chain concern rather than a mere style issue. Documentation that repeatedly instructs users to execute mutable package references increases the attack surface and the likelihood of unsafe copy/paste execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This tool-link section still uses an unpinned npx skills installation snippet, leaving users dependent on the current state of the registry. In a security review, that is a real vulnerability because it can lead to arbitrary code execution during setup if the package source is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command on this line does not pin the skills package version, allowing future or malicious package changes to alter execution. Because this appears in a quick-reference section, it is especially likely to be copied directly by users without scrutiny.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned npx install command is present here, exposing users to registry and dependency-chain compromise during tool setup. The skill's reliance on external integrations means an attacker who gains code execution at install time could target API credentials and user data flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This installation example again executes a package selected dynamically by npx, which is unsafe for reproducible and secure setup. The repeated pattern across the document increases operational risk because any copied command may trigger untrusted code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The reference entry at this line points users to an unpinned npx skills command, preserving the same supply-chain weakness found elsewhere in the file. Since these references are part of the official setup path, the issue is actionable and not just theoretical.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command uses npx skills with no version constraint, meaning users can unknowingly execute changed or malicious code from the package registry. In the context of a workflow skill that interfaces with third-party accounts, installer compromise could also lead to downstream account abuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Missing User Warnings

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Static analysis